Extracted

• • Target

    SecuriteInfo.com.Exploit.CVE-2018-0798.4.6123.12270.rtf

  • Size

    3KB

  • MD5

    7a7d9b82e6d26b4d575ac0a5cd93faff

  • SHA1

    ce64d85889744473fa305c3e51cd50c58fb4a7ce

  • SHA256

    53dced2862d890b9c606cf475d09241f33dda53eb131af8a501ce1453b0aa56d

  • SHA512

    a08071efa1b27bb0d423d7b0670c8a6b1020dbf875a373676c4052e84b935d87a617ad77e1765117eb1883eb26ed43f88f3fe89de70c73661f9b721e6cda110c

  Score

  10^/10

  formbook8rmtratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2